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DETAILED ACTION 

Examiner Statement of Reasons for Allowance 

1. Claims 1-22 are allowed over prior art. 

2. This action is in reply to applicant's correspondence of 24 September 2007. 

3. The following is an examiner's statement of reasons for the indication of allowable 
claimed subject matter. 

4. As per claims 21 and 22 generally, prior art of record, Amold et al, U.S. Patent No. 
6,981,279 Bl, fails to teach alone, or in combination, at the time of the invention, the features as 
discussed and remarked upon in the response of 24 September 2007 to office action of 25 June 
2007. 

Specifically, (as per claim 22, for example) prior art dealing with the ability to detect 
"zero-day" email malware via behavior-based anomaly detection techniques (i.e., using an 
instrumented virtual machine architecture to look for dangerous actions, such as registry 
modification, in all email content, via emulation/virtual mail reader/agent processing network 
elements; Sidiroglou. S.. et a!, 'An Email Worm Vaccine Architecture', 2005, Dept. of Computer Science. Columbia 
University, entire document, http://vvww1.cs.columbia.edu/--angelos/Papers/2005/emall-worm.pdf), is generally 
known per se. Nowhere in the prior art is found collectively the italicized claim elements (i.e., 
using an associated SMTP proxy (connection 'destination*) to compare an executable behavior of 
associated SMTP executable client applications, and more specifically to compare the effects of 
'decrypted' application performance/memory effects (i.e., dirty page(s) results) insofar as the 
intercepted executing application (i.e., representing possible malware/malware attachment(s)) is 
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compared to the executable performance of a 'standard'), at the time of the invention, serving to 
patently distinguish the invention from said prior art; 



"22. A method comprising: 

establishing a SMTP proxy; 
defining an application 

that forms a connection with 
said SMTP proxy as 

a SMTP client application^ 

decrypting 

said SMTP client application', 
intercepting an executable application 

sent from 

said SMTP client application 

with 

said SMTP proxy; 

decrypting 

said executable application; and 
determining whether 

said SMTP client application 
when decrypted 

is the same as 
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said executable application 
when decrypted''. 



5. Dependent claims 1-20 are allowable by virtue of their dependencies. 
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Conclusion 



6. Any inquiry concerning this communication or earlier conununications from examiner 
should be directed to Ronald Baum, whose telephone number is (571) 272-3861, and whose 
unofficial Fax number is (571) 273-3861 and unofficial email is Ronald.baum@uspto.gov. The 
examiner can normally be reached Monday through Thursday from 8:00 AM to 5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser Moazzami, can be reached at (571) 272-4195. The Fax number for the 
organization where this application is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. For more information for 
unpublished applications is available through Private PAIR only. For more information about the 
PAIR system, see http ://pair-direct. uspto . gov . Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Ronald Baum 




Patent Examiner 



